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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address — 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )KI Responsive to communication(s) filed on 09 October 2009 . 
2a )□ This action is FINAL. 2b)^ This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-91 is/are pending in the application. 

4a) Of the above claim(s) 36-68 and 80-87 is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) |EI Claim(s) 1-35,69-79 and 88-91 is/are rejected. 

7) 0 Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) Q The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

20 Certified copies of the priority documents have been received in Application No. . 

3.Q Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mail Date. . 

3) □ Information Disclosure Statement(s) (PTO/SB/08) 5 ) □ Notice of Informal Patent Application 

Paper No(s)/Mail Date . 6) □ Other: . 
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DETAILED ACTION 

1. This action is in response to the communication 10/09/2009. Claims 1 - 91 are currently 
pending. Claims 36 - 68, 80 - 87 have been cancelled. Claims 1 - 35, 69 - 79 and 88 - 91 
have been examined. 

Response to Arguments 

2. Applicant's arguments with respect to prior art rejection of claims 1 - 35 have been fully 
considered but they are not persuasive. Applicant primarily argues the references, even when 
combined do not teach "automatically identifying new signatures to use in identifying previously 
unknown intrusive network attack" and "reduce said collection to a reduced data collection to 
reduce said data collection". Examiner disagrees and directs the Applicant's attention to 
"detecting new vulnerabilities and implementing the signature of the new vulnerabilities (TEAL) 
and "event classification and processing/analyzing of sub/several events (Hrabik et al)" 
correspond to the claimed subject matter as detailed in the previous office action. Examiner 
maintains previous Examiner's prior art rejection (mailed 8/12/2009) for Claim 1 and all of the 
dependent claims of 1, by the virtue of their dependency and requests to amend the 
Independent claim 1 similar to the allowed subject matter that is detailed in item #5. 

Additionally, please refer to item #4 for obviousness-type double patenting rejection. 

3. Applicant's arguments with respect to the rejection(s) of claim(s) 69 - 79 and 81 - 91 
under prior art rejection have been fully considered and are persuasive. Therefore, the rejection 
has been withdrawn. Please refer to item #5. However, upon further consideration, a new 
ground(s) of rejection is made in view of obviousness-type double patenting rejection. 
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Double Patenting 

The nonstatutory double patenting rejection is based on a judicially created doctrine 
grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or 
improper timewise extension of the "right to exclude" granted by a patent and to prevent 
possible harassment by multiple assignees. A nonstatutory obviousness-type double patenting 
rejection is appropriate where the conflicting claims are not identical, but at least one examined 
application claim is not patentably distinct from the reference claim(s) because the examined 
application claim is either anticipated by, or would have been obvious over, the reference 
claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re 
Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 
USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re 
Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 
USPQ 644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1 .321 (c) or 1 .321 (d) may be 
used to overcome an actual or provisional rejection based on a nonstatutory double patenting 
ground provided the conflicting application or patent either is shown to be commonly owned with 
this application, or claims an invention made as a result of activities undertaken within the scope 
of a joint research agreement. 

Effective January 1, 1994, a registered attorney or agent of record may sign a terminal 
disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 CFR 
3.73(b). 



4. Claims 1 - 35, 69 - 79 and 88 - 91 are rejected on the ground of nonstatutory 
obviousness-type double patenting as being unpatentable over 

a. claims 1 -7, 9 - 20 and 22 - 26 of copending application 11/271,133, 

b. claims 1 - 20 of Patent 7,535,909. 

Although the conflicting claims are not identical, they are not patentably distinct from 
each other because claims of instant application are analogous to or an obvious variation of: 

The claims of the copending applications and of the patent contain every element of 
claims 1 - 35, 69 - 79 and 88 - 91 of the instant application and thus anticipate the claims of 
the instant application. Claims 1 - 35, 69 - 79 and 88 - 91 of the instant application therefore 
are not patently distinct from the copending application claims and as such are unpatentable for 
obvious-type double patenting. A later patent/application claim is not patentably distinct from an 
earlier claim if the later claim is anticipated by the earlier claim. Furthermore, there is no 
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apparent reason why applicant would be prevented from presenting claims corresponding to 
those of the instant application in the other copending application. See In re Schneller, 397 
F.2d 350, 158 USPQ 210 (CCPA 1968). See also MPEP § 804. 

Claims of the instant application are anticipated by patent claims in that the patent 
claims contains all the limitations of the instant application. Claims of the instant application 
therefore is not patentably distinct from the earlier patent claims and as such are unpatentable 
for obvious-type double patenting (In re Goodman (CAFC) 29 USPQ2d 2010 (12/3/1993). 

Allowable Subject Matter 

5. Claims 1 - 35, 69 - 79 and 88 - 91 are allowed. Examiner suggests filing the Terminal 
Disclaimer to overcome the obviousness-type double patenting rejection. 

Any comments considered necessary by applicant must be submitted no later than the 
payment of the issue fee and, to avoid processing delays, should preferably accompany the 
issue fee. Such submissions should be clearly labeled "Comments on Statement of Reasons 
for Allowance." 

Conclusion 

Examiner's Note: Please not the change in Examiner with this application. 

The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. See PTO Form 892. 

Applicant is urged to consider the references. However, the references should be 
evaluated by what they suggest to one versed in the art, rather than by their specific disclosure. 
If applicants are aware of any better prior art than those are cited, they are required to bring the 
prior art to the attention of the examiner. 
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Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to PRAM I LA PARTHASARATHY whose telephone number is (571)272- 
3866. The examiner can normally be reached on 8:00a.m. to 5:00p.m.. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Nasser Moazzami can be reached on 571-272-4195. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you 
would like assistance from a USPTO Customer Service Representative or access to the 
automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Pramila Parthasarathy/ 
Primary Examiner, Art Unit 2436 



